IBM MQ CVE-2026-13265

Three concrete conditions must simultaneously be true: (1) the IBM MQ installation includes the MFT (Managed File Transfer) component and the mqweb server is running and network-accessible; (2) the attacker possesses valid IBM MQ credentials authenticated to the queue manager; and (3) those credentials carry specifically the MFT publish authority permission, which is not granted by default to standard MQ users and must be explicitly assigned by an administrator. The AC:H CVSS rating reflects this multi-factor prerequisite. Exploitation is limited by: the non-default nature of the MFT component deployment, the specific publish authority role requirement beyond base authentication, and network reachability to the mqweb port. Standard MQ channel/queue access credentials without the MFT publish authority role are insufficient.

The official CVSS 3.1 score of 6.8 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H accurately reflects a genuinely constrained attack surface. Network reachability (AV:N) is required, but the high attack complexity (AC:H) and low-privilege authentication (PR:L) - specifically MFT publish authority, not mere authenticated access - substantially narrow the realistic attacker population. The dual high impacts (C:H for file disclosure, A:H for DoS) are meaningful but scoped to the MQ server process itself (S:U, unchanged scope). No EPSS data was provided in source intelligence, no KEV listing exists, and no public POC has been reported. This vulnerability should be prioritized for environments where the MFT component is deployed and web API access is broadly granted, but it does not warrant emergency response in the absence of active exploitation signals. The AC:H rating is consistent with requiring a specific privilege role rather than reflecting any inherent exploitation difficulty once those prerequisites are met.

An attacker who has obtained IBM MQ credentials bearing the MFT publish authority role - through credential theft, insider access, or permission misconfiguration - sends an HTTP POST to the mqweb MFT REST API containing a crafted XML body with a DOCTYPE declaration that defines an external entity referencing a local file path such as /etc/passwd or an IBM MQ keystore file. The Liberty-based XML parser resolves the entity and includes the file contents in the parsed document, which may be returned in the API response or trigger a server-side request causing resource exhaustion. No public proof-of-concept code is known at time of analysis.